> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Multi-Tenancy and Separation of Duties

A single OneFirewall Server instance can serve multiple independent tenants. In the platform, a tenant is called an **organization**.

***

## Deployment

OneFirewall Server is one instance that can run on-prem, in a private cloud, or in the public cloud. The global Alliance is served from `app.onefirewall.com`.

For an on-prem or private cloud installation:

* The server needs a VM or a Kubernetes cluster.
* The installation is multi-tenant by default.

***

## Organizations

An organization is an independent logical group. Each organization has its own:

* Users
* Feeds
* Crime Score
* Preventive Mode
* WCF installations
* Other configuration

Nothing is shared between organizations except shared intelligence.

***

## Users

* A user belongs to exactly one organization.
* Every action a user takes applies only to that organization.
* A user cannot see or change the installation configuration of another organization.

***

## Isolation between organizations

| Item                | Shared between organizations? |
| ------------------- | ----------------------------- |
| Users               | No                            |
| Feeds               | No                            |
| Crime Score         | No                            |
| Preventive Mode     | No                            |
| WCF installations   | No                            |
| Configuration       | No                            |
| Threat intelligence | Yes                           |

Organizations do not interact with each other. The only exchange is the intelligence shared.

***

## Use cases

One instance can serve several parties, each with its own rules, separation of duties and confidentiality:

* **Divisions of one company**: for example subsidiaries, regions or business units that need separate policies and data visibility.
* **Separate customers**: for example an MSSP serving customers that must be logically separated.